cve-2025-50428

CVE-2025-50428 - RaspAP 命令注入 CVE-2025-50428 的概念验证漏洞利用程序，针对 RaspAP raspap-webgui 3.2.9 及更早版本中的命令注入漏洞。 漏洞 ID| CVE-2025-50428 ---|--- 严重性| 高 CVSS 3.1: 8.6 CVSS 向量| CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 漏洞类型| 代码注入 攻击向量| 远程（已认证） 所需权限| 低 影响| 代码执行、权限提升 受影响产品| raspap-webgui ≤...

CVE-2026-101860

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack...

CVE-2026-101858

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

CVE-2026-101859

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CVE-2026-101860 RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack...

EUVD-2026-88604

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack...

CVE-2026-101859 RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

EUVD-2026-88603

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CVE-2026-101859 RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CVE-2026-101859

A vulnerability exists in RaspAP raspap-webgui up to version 3.5.5 within the OpenVPN Configuration Handler component. The root cause is an os command injection vulnerability in the escapeshellcmd function of the ajax/openvpn/del_ovpncfg.php file. Attackers can exploit this by manipulating the cf...

CVE-2026-101858 RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

CVE-2026-101858

A flaw in RaspAP raspap-webgui versions up to 3.5.5 allows for OS command injection . The vulnerability exists within the SSID Processing component, specifically in the WiFiManager::writeWpaSupplicant function located in the file src/RaspAP/Networking/Hotspot/WiFiManager.php. Attackers can achiev...

EUVD-2026-88601

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

CVE-2026-101858 RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

PT-2026-102427

Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui versions prior to 3.5.6 Description An OS command injection flaw exists in the OpenVPN Configuration Handler component. The issue occurs within the escapeshellcmd function located in the ajax/openvpn/del ovpncfg.php file. ...

CVE-2026-101858: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the component SSID Processing. This manipulation of the argument ssid causes os command injection. The attack can be...

CVE-2026-101860: Improper Privilege Management

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack...

CVE-2026-101859: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

PT-2026-102420

Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui versions prior to 3.5.6 Description An OS command injection flaw exists in the SSID Processing component. The issue occurs within the WiFiManager::writeWpaSupplicant function located in the...

PT-2026-102428

Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui versions prior to 3.5.6 Description Improper privilege management occurs within the PluginInstaller::addSudoers function located in the src/RaspAP/Plugins/PluginInstaller.php file of the sudo Configuration component. This...